<html>
<head><meta charset="utf-8"><title>Aliasing and Stacked Borrows · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing.20and.20Stacked.20Borrows.html">Aliasing and Stacked Borrows</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="234782100"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing%20and%20Stacked%20Borrows/near/234782100" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Brandon Falk <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing.20and.20Stacked.20Borrows.html#234782100">(Apr 16 2021 at 01:51)</a>:</h4>
<p>Heya! I've got a decent amount of questions about aliasing and stacked borrows. I think the first question I have, what are the mechanics of turning a reference (mutable or not) into a pointer, into a usize? I'd imagine the tagging is no longer tracked upon becoming a usize?</p>



<a name="234803046"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing%20and%20Stacked%20Borrows/near/234803046" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Pointerbender <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing.20and.20Stacked.20Borrows.html#234803046">(Apr 16 2021 at 06:55)</a>:</h4>
<p><span class="user-mention" data-user-id="356799">@Brandon Falk</span> It looks like Miri handles the tagging of  just fine if you cast a pointer to a <code>usize</code> and then back to a pointer (<a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=2a5a0284de888f7f27a3f54619a9c1d2">playground example</a>,  go to Tools &gt; Miri). But there might be other pitfalls to consider: as of up until <a href="https://github.com/rust-lang/miri/issues/1318">one year ago</a>, pointer provenance is lost when you cast a pointer to a <code>usize</code>. But I don't know if anything has changed since then. Here is another interesting recent <a href="https://www.ralfj.de/blog/2020/12/14/provenance.html">blog post</a> that reasons about the implications of preserving provenance when converting pointers to <code>usize</code> and vice versa (it's a very interesting read if you have the time, the implications are quite surprising!).</p>



<a name="234915914"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing%20and%20Stacked%20Borrows/near/234915914" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Brandon Falk <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing.20and.20Stacked.20Borrows.html#234915914">(Apr 16 2021 at 20:30)</a>:</h4>
<p>Oooh, gonna have to read these. This is a fascinating topic to me and one of the only places I feel a bit uncomfortable in Rust. I've maintained a safe-transmute style library for a few years and I struggle to sleep at night when I think about aliasing!</p>



<a name="234973465"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing%20and%20Stacked%20Borrows/near/234973465" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing.20and.20Stacked.20Borrows.html#234973465">(Apr 17 2021 at 08:56)</a>:</h4>
<p><span class="user-mention" data-user-id="356799">@Brandon Falk</span> well congrats, you managed to start with one of the most complicated questions there is. :)</p>



<a name="234973498"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing%20and%20Stacked%20Borrows/near/234973498" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing.20and.20Stacked.20Borrows.html#234973498">(Apr 17 2021 at 08:58)</a>:</h4>
<p>That aforementioned <a href="https://www.ralfj.de/blog/2020/12/14/provenance.html">blog post</a> should get you some idea for why it is complicated -- and note that this complication arises for provenance in general, i.e., it also arises in C; but provenance is much more prominent in Rust so it's more "in your face" here.</p>



<a name="234973756"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing%20and%20Stacked%20Borrows/near/234973756" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Aliasing.20and.20Stacked.20Borrows.html#234973756">(Apr 17 2021 at 09:02)</a>:</h4>
<p>The current concrete status is:</p>
<ul>
<li>Miri will remove the tag from the ptr (mark it "untagged") when you do ref-to-rawptr conversion. Nothing more happens here when you turn the raw ptr into a usize (well there is some other provenance info that you lose but this is less relevant here). When you turn the usize back into a raw ptr it remains untagged and so essentially becomes the same raw ptr as what it was before the cast roundtrip. (This is in the "happy case" where the ptr is strictly in-bounds of an allocation. Out-of-bounds and one-past-the-end ptrs make this more complicated, that's what the blog post is about.)</li>
<li>However, this is not intended to be the final model: making all raw ptr untagged is Not Great, IMO, so we <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/248">track it as an issue</a>. Miri provides the <code>-Zmiri-track-raw-pointers</code> flag to experiment with more precise tracking of raw pointers.However, with that flag, currently if you cast a ptr to a usize and back the resulting ptr is unusable -- int-to-ptr casts are not supported by this model. Working out how to best support them is something I hope to do eventually.</li>
</ul>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>